// hands-on, not hypothetical
Learn offensive security by doing the work
Guided labs, a CTF arena, and vulnerability analysis with the working shown. Everything runs in the browser — no VM to configure, no local environment to maintain.
- Browser-based labs, zero setup
- Points, ranks, shareable badges
- Beginner to advanced difficulty
- AI hints when you get stuck
Free tier, no card. 30-day money-back guarantee on paid plans.
Lab session transcript. Command: cvk lab start blind-ssrf-to-cloud-metadata. resolving image ... web-exploit:2026.07 allocating slot ... 1 of 1 (Recon tier) sandbox ready ... 00:29:41 remaining Command: curl -s https://target.lab.internal/render -d @job.json. HTTP/1.1 202 Accepted collaborator: DNS lookup received, no HTTP connection that is a result, not a dead end. keep going.
- 0
- VMs to configure
- 30
- Day guarantee
- 8
- Training disciplines
- 4
- Learning formats
Labs run in the browser
On every paid plan
Web exploitation to OSINT and beyond
Labs, CTF, CVE analysis, coding practice
Eight disciplines, one platform
Web exploitation, cloud security, forensics, OSINT, reverse engineering, and more — structured as labs and CTF rooms so the domain stays paired with the practice.
- Web exploitation
- Access control
- Cloud security
- Detection engineering
- Reverse engineering
- Digital forensics
- OSINT
- Capture the flag
Built around doing, not watching
Labs in isolated sandboxes, a CTF arena with per-user flags, CVE breakdowns with detection artifacts, and tier limits stated as real numbers rather than fair-use clauses.
Live rooms, and a flag that's actually yours.
Web, pwn, crypto, forensics, and Active Directory rooms, ranked and timed. Flags are derived per user, per challenge, so every position on the scoreboard reflects work you actually did.
- Ranked and timed rooms
- Per-user dynamic flags
- Hints, never spoilers
- Public leaderboard
Ledger Drift
480 pts- HTTP request analysis
- Access control testing
- Parameter discovery
- Chaining two low-severity findings
Practice the code an exploit actually needs.
Write the parsers, validators, and small tools that pentesting and defensive work actually runs on. Every submission is graded by AI with the full reasoning shown — not just a pass or fail.
- AI-graded, with reasoning shown
- Python, Bash, PowerShell, more
- Beginner to advanced
- Instant feedback, in the browser
def sanitize_query(user_input: str) -> str:
"""Reject anything that looks like a SQL injection attempt."""
blocked = ("--", ";", "/*", "*/", "xp_", "union select")
lowered = user_input.lower()
for pattern in blocked:
if pattern in lowered:
raise ValueError(f"blocked pattern: {pattern!r}")
return user_inputUnauthenticated SSRF in Examplecorp Edge Gateway document rendering
An unauthenticated request to the document rendering endpoint causes the gateway to fetch a URL of the caller choosing from inside the trust boundary. Versions 7.0.0 through 7.4.1 are affected. A patch is available in 7.4.2 and the flaw is on the CISA KEV catalogue.
- CVSS v4
- 9.3
- EPSS
- 0.72
- KEV
- 30 July 2026
- Updated
- 4 August 2026
title: Edge gateway process connecting to internal or link-local address
id: 5c0e0f2a-4a5d-4a0e-9d6e-3f1a2b7c8d90
status: experimental
description: >
Detects the document rendering worker opening an outbound connection to a
link-local or RFC 1918 destination. Written for the CVE-2026-99001 class:
the inbound request is unremarkable, the outbound connection is not.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Cyber VK detection engineering
date: 2026/07/28
logsource:
category: network_connection
detection:
selection_process:
Image|endswith:
- '/edge-gateway-render'
- '\edge-gateway-render.exe'
selection_destination:
DestinationIp|cidr:
- '169.254.0.0/16'
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '127.0.0.0/8'
filter_known_internal_assets:
# TUNE THIS FIRST. Add every internal host the renderer legitimately
# fetches from, with a comment saying why, before enabling the rule.
DestinationIp:
- '10.20.0.0/24'
condition: selection_process and selection_destination and not filter_known_internal_assets
falsepositives:
- Internal asset hosts that have not been added to the filter
- Health checks and service discovery traffic from the same image
level: highWhat practitioners say
“I worked through the web exploitation labs over two weekends and finally understood why certain vulnerabilities reach production. The walkthroughs show the reasoning, not just the commands to run.”
“The per-user CTF flags meant I had to actually understand each step — I could not just copy a writeup and submit. That single constraint changed how much I retained.”
“Coming from web development, the CVE breakdowns with detection rules attached were the thing that made offensive security click for me. I went from reading advisories to understanding root causes.”
Certification vouchers, delivered after verified payment
Buy examination and training voucher codes without creating an account. Inventory is checked before checkout, and the unique code is released only after payment is verified.
One lab and one CTF room, free, no card
The Recon tier is free forever. It includes the full glossary, every CVE breakdown, one guided lab and one CTF room — enough to see exactly how the platform works before committing to a paid plan.